Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable.
Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS).
Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo.
Refs: .task/fix-followup-hardening.md, Backend PR #25
Why: Dev gitlinks lagged behind merged module mains (backend fa494c3,
frontend b067b57, documents f0361f38, plus deps advances); the integrated
build should track each repo's main.
Evidence: make pin advanced all listed submodules; make test exit 0
(frontend 33/33, ui 37/37, backend go test all ok, agent-command ok).
Impact: gitlink bumps only, no source changes.
Refs: housekeeping after chat-process-split-r1 (PR #79)
Why: PR #73 merged a branch whose worktree carried stale submodule
pointers, regressing modules/{backend,documents,frontend,ui} on main to
pre-#71 commits; documents also advanced with the file-preview proposal
(PR #23).
Evidence: submodule status now matches each module's main tip
(backend 239cf76, documents 5882448+, frontend fb219e0, ui efa6c69,
core fd44179 unchanged); make test combo verification green.
Impact: composed checkout sees the merged chat-order and proposal work
again; no source changes in this repo beyond pointers and the task card.
Refs: task feature/file-preview-proposal.
Why: the origin/main merge recorded a stale ui pointer (c7564791); this
branch verifies against efa6c69 (ui main), which carries the icons the
merged frontend needs.
Evidence: git submodule status shows checkout efa6c69 (ui origin/main);
frontend tsc -b exit 0 and vitest 33/33 against it.
Impact: gitlink update only.
Refs: feature/chat-process-split-r1
Why: frontend 6483757 fixes the tsc breakage left by the main merge and
ports artifact events onto the items stream.
Evidence: tsc -b exit 0; vitest 33/33.
Impact: gitlink update only.
Refs: feature/chat-process-split-r1
Why: card must carry result and verification state before review.
Evidence: targeted behavior checks recorded in the card; bash -n passed.
Impact: documentation only.
Refs: feature-gitea-access-facts
Why: task-sync requires a clean tree; both submodule branches now carry
merges of their respective mains (backend 9e694c0, frontend 765789f).
Evidence: git submodule status shows the new SHAs; backend go test ./...
ok after its merge; frontend vitest 32/32 after its merge.
Impact: gitlink update only.
Refs: feature/chat-process-split-r1
Why: the review of feature/chat-process-split-r1 required untracking the
frontend node_modules symlink, per-turn interleaving of live parts with
tool-call-driven process marking, a long-reply excerpt, and marking
artifact_ref parts as process in the backend.
Evidence: frontend 22a8723 (untrack symlink) + 754ce83 (interleave and
mark); backend ae8e5d0 (artifact process). make test green: frontend
27/27, ui 35/35, backend go test ./... ok.
Impact: parent task branch now points at the reviewed submodule commits;
ready for PR.
Refs: code review of feature/chat-process-split-r1 (2026-09-30)
Why: make contracts regenerates modules/ui/src/contracts.ts from Core
as authority; the mirror commit (UI PR #15) must be pinned or the
combined tree stays dirty after make test.
Evidence: UI PR #15 merged on ui main; make test re-run on this tree
below.
Impact: gitlink-only change.
Refs: Core PR #6; UI PR #15; Dev task feature/cross-session-reading.
Why: integrate the approved cross-session reading feature (proposal +
core contract + backend gate/tools/UI) into the Dev composition.
Evidence: subrepo PRs all merged on their mains — Documents #21
(bf0988b), Core #6 (fd44179), Backend #18 (cb7f79d), Frontend #16
(9c87953); combined make test to follow on this exact tree before the
Dev PR is requested.
Impact: gitlink-only change plus task card; no Dev-repo code touched.
Refs: modules/documents/docs/proposals/2026-09-30-cross-session-reading.md;
task card .task/feature-cross-session-reading.md.
Why: R-platform spans core/ui/frontend/documents; also honors the
agreed housekeeping item — .env.dev must be gitignored (it holds live
API keys).
Evidence: make test full suite green on this head (exit 0); headless
walk on the real binary: avatar columns, settings shell with badges,
admin-row avatars, zero console errors.
Impact: capability layer only, no behavior changes. Merge order:
core -> ui -> frontend -> documents -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (capability platform)
Why: R4 spans ui (token scale) and frontend (icon set + restyle); the
Dev repo advances pointers and the task record.
Evidence: make test full suite green on this head (exit 0); headless
journey on the real binary across both themes with zero console errors
and zero leftover emoji glyphs.
Impact: pure visual layer. Merge order: ui -> frontend -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (R4)
Why: R2 spans backend (migration v10, auth/session APIs, CLI user
subcommands), frontend (login page, forced change gate, admin user
management), documents (decision record).
Evidence: make test full suite green on this head (exit 0); headless
journey on the real binary with --auth on covers admin bootstrap,
first-login forced change for created and reset passwords, non-admin
menu gating, API-key login, logout.
Impact: auth-enabled deployments gain password login and admin account
management; embedded no-auth mode unchanged. Merge order: backend ->
frontend -> documents -> this PR.
Refs: proposal 2026-09-30-ui-redesign-and-auth.md (R2 admin-issued)
Why: give the catalog's WebSearch prompt a carrier by registering
Agent-Native's Tavily tools behind settings, with library copy on top.
Evidence: backend 16 packages green incl. 4 new search tests; live
boot checks for both unconfigured and configured states.
Impact: pins backend 0d55ebb, documents b4546fe.
Refs: feature/tavily-search-tool task card.
Why: close the coverage gap against the user's take-everything-portable
bar and record the porting rule.
Evidence: backend 16 packages green at 44-module floor; documents guide
section 9 carries the full disposition table.
Impact: pins backend ed036cb, documents 60bb2ed.
Refs: feature/prompt-catalog-coverage task card.
Why: R1 implementation spans core (Conversation flags), backend
(migration v8, task list APIs, /api/me), frontend (TaskSidebar rebuild),
ui (contracts mirror), documents (proposal acceptance record); the Dev
repo advances the pointers and the task record.
Evidence:
- make test full suite green on this head (core+backend+frontend+ui+
agent-command, exit 0) before advancing gitlinks.
- Headless walk on the built binary: cross-project task open, pinned-
first ordering, archive hide/show/restore, new-task flow, account
footer identity, zero console errors.
Impact: UI restructure per approved option A; no mid-column or inbox
changes (D25/D26/D31 intact). Merge order: core -> backend -> ui ->
frontend -> documents -> this PR.
Refs: proposal docs/proposals/2026-09-30-ui-redesign-and-auth.md (option A, R1)
Why: prompts move from hardcoded strings to a layered embed library
with trigger-based assembly, user overrides and observability.
Evidence: composite make test green over this combo; runtime check on a
live mock server (40 modules, 7 layers, override round-trip, skill
command routing); task card records results and remaining items.
Impact: pins core 0cb0a40, backend 4938bd0 (with its vendored core
gitlink), frontend 4abf13d, documents 2715ed6.
Refs: feature/prompt-library task card; design guide in Documents.
Why: the archived card still had a placeholder for its main-record PR
link, and the combo pins pointed at feature-branch commits instead of
the merged submodule main tips.
Evidence: Dev PR #29 merged as c6f5368; submodule PRs Frontend #9, UI
#9, Backend #12 merged (tips 0eb90665, 6068f146, 10f400a2, content
identical to the pinned feature commits).
Impact: one-line card backfill plus three gitlink advances; no code
change.
Why: the UI redesign proposal and demos live in the Documents repo; the
Dev repo advances only the submodule pointer and the task record.
Evidence:
- modules/documents -> e601b25 (proposal + 5 HTML demos; verified headless,
see that commit); make test full suite passed before advancing the
gitlink (core+backend+frontend+deps, exit 0).
- Task card filled with outcome, verification, and the pending user
decision (direction A/B/C, auth stage-2 scope).
Impact: gitlink + .task only; no code change. Documents PR #14 carries
the content; merge order: Documents PR first, then this PR.
Refs: Documents PR https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Documents/pulls/14
Why: the shipped chat column showed nothing until a run finished, blew
up markdown spacing, and gutted long documents before the model saw
them.
Evidence: composite make test green over this combo (backend 16 pkgs
incl. new ctxasm/ingest tests, frontend 9, ui 23); headless E2E on the
mock backend confirmed live thinking/tool/text streaming and compact
list geometry.
Impact: pins frontend 616795b, ui 0689d72, backend fe4887b; task card
records results and remaining user-side acceptance on a real model.
Refs: feature/chat-live-quality task card.
Why: the chat page could not scroll once messages exceeded the viewport
and the input bar was pushed off-screen (missing min-height:0 on the
column flex chain .main->.chat->.chat-body).
Evidence: combo make test green with the advanced frontend gitlink;
headless-Chromium before/after measurements and four layout variants
recorded in the task card.
Impact: middle column only; also ignore /data-test/ local runtime data
so precheck does not report BUSY on the user's test artifacts.
Refs: Agent-System-Frontend a54022c (feature/chat-scroll-fix).
Why: T5 closes the interaction-foundation proposal (T0-T5); the Dev combo pins the verified combination.
Evidence: zero-page walkthrough 12/12 PASS on a fresh real binary; combo make test PASS at pinned heads; records at documents docs/records/2026-09-30-t5-polish-verification.md (PR#13).
Impact: gitlinks frontend/documents updated; task card backfilled; no Dev-side code change.
Refs: task card feature/polish-r1; proposal T5
Why: T3 submodule PRs merged (backend #10, ui #7, frontend #6, documents #11) and the Dev combo must pin the verified combination.
Evidence: combo make test PASS at pinned heads (backend 15 pkgs incl. cmdbuf; ui 18/18; frontend 9/9); record at documents docs/records/2026-09-30-t3-command-bus-verification.md (PR#11).
Impact: gitlinks backend=0f74026 frontend=6a2b21a ui=76f976d documents=<PR#11 head>; task card backfilled; no Dev-side code change.
Refs: task card feature/command-bus-r1; proposal T3
Why: Backend merged its consumer-adaptation PR (nested core/agent-command
pins); the Dev combo must pin that merge so the tested combination is the
publishable one.
Evidence: full make test re-run at this exact combo (see task card evidence).
Impact: gitlink only.
Refs: modules/documents docs/records/2026-09-30-t1-core-cards-commands-verification.md
Why: Provider repos merged for T1 (core PR#2, agent-command PR#2, frontend
PR#3, ui PR#3, documents PR#9); gitlinks pinned to those mains. The
task-finish guard prevents a repeat of the T0 incident where running
finish from the main checkout deleted it (scripts/task.sh treated $PWD as
the worktree to remove).
Evidence: make test green on the pinned combo — core, backend 13 pkgs,
frontend 9, ui 6, agent-command (vet + tests incl. conformance); make build
produces the binary; combo version string now includes agentcmd SHA.
Impact: combo grows its version traceability; AGENTS.md documents the
worktree-cwd requirement for finish.
Refs: modules/documents docs/records/2026-09-30-t1-core-cards-commands-verification.md
Why: Foundation task T0 of the UI/interaction base (proposal 2026-09-30,
D25-D33): add the new UI component library and command-bus ecosystem repos,
extend build/test/pin orchestration to twelve submodules.
Evidence: make test green on the pinned combo (core + backend 13 pkgs +
frontend 9 + ui 6 tests); make build produces bin/agent-system with combo
version string including ui; make contracts now generates to frontend and ui
with submodules staying clean; renderer/tokens migration verified
CSS-rule-identical (zero behavior change).
Impact: New modules/ui and deps/agent-command gitlinks; frontend consumes ui
via source alias; backend vendors agent-command (replace only, no import
yet); follows provider-first merges (ui PR#1/#2, agent-command PR#1,
documents PR#8, frontend PR#2, backend PR#6).
Refs: modules/documents docs/proposals/2026-09-30-ui-inbox-command-workspace.md
weichen
weichen